Technical Information
Malicious functions:
Creates and executes the following:
- C:\kyxnjeor.exe
- C:\eqqc.exe
- C:\gwtdxo.exe
- C:\-1998166001
- C:\fivn.exe
- C:\vejdh.exe
- C:\cwxt.exe
- C:\acqdgllh.exe
- C:\-1998166001 (downloaded from the Internet)
- C:\eqqc.exe (downloaded from the Internet)
- C:\acqdgllh.exe (downloaded from the Internet)
- C:\vejdh.exe (downloaded from the Internet)
- C:\cwxt.exe (downloaded from the Internet)
- C:\fivn.exe (downloaded from the Internet)
- C:\gwtdxo.exe (downloaded from the Internet)
- C:\kyxnjeor.exe (downloaded from the Internet)
Modifies file system :
Creates the following files:
- C:\eqqc.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\scqqd[1].php
- C:\gwtdxo.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ekyymmqe[1].php
- C:\acqdgllh.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\roopttxy[1].php
- C:\-1998166001
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\qjxkoptg[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zwjkbb[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\xdqrivm[1].php
- C:\vejdh.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zjjaof[1].php
- C:\cwxt.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\agqqerbspt[1].php
- C:\kyxnjeor.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\clzqdervli[1].php
- C:\fivn.exe
Deletes itself.
Network activity:
Connects to:
- 'aa####liance.com':80
TCP:
HTTP GET requests:
- aa####liance.com/progs/jhnrrff/scqqd.php?ad########
- aa####liance.com/progs/jhnrrff/ekyymmqe.php
- aa####liance.com/progs/jhnrrff/roopttxy.php?ad#################################################
- aa####liance.com/progs/jhnrrff/qjxkoptg.php
- aa####liance.com/progs/jhnrrff/zwjkbb
- aa####liance.com/progs/jhnrrff/xdqrivm.php
- aa####liance.com/progs/jhnrrff/zjjaof.php
- aa####liance.com/progs/jhnrrff/agqqerbspt.php
- aa####liance.com/progs/jhnrrff/clzqdervli.php
UDP:
- DNS ASK aa####liance.com